Pandora's handling of Direct Access Archive (DAA) files includes a denial-of-service vulnerability (CWE-434) where compressed chunks are decompressed without limits on the uncompressed size. This allows an attacker to craft a DAA file that decompresses into a very large amount of data, exhausting memory and CPU resources during extraction of the internal ISO image. The vulnerability affects Pandora versions up to and including 1.12.5. The patch introduces bounded decompression with a maximum extracted file size limit and raises a ZipBomb exception if exceeded, aborting extraction and preventing resource exhaustion.

Successful exploitation results in denial of service by exhausting memory and CPU resources on the Pandora service, causing extraction workers to become unresponsive or terminate. This impacts the availability of the Pandora service but does not indicate privilege escalation, data disclosure, or integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described patch approach uses bounded decompression with limits on uncompressed data size and aborts extraction when limits are exceeded. Until an official fix is available, avoid processing untrusted DAA files or implement resource usage monitoring to detect abnormal decompression behavior.